Add wolfjsse.autoSNI Security property

[gasbytes]

Introduce wolfjsse.autoSNI property to make SNI behavior configurable. When
set to true, enables legacy automatic SNI based on hostname/peer. By default,
SNI is only set through explicit SSLParameters configuration.

• Fixes SSLSocketExplorerWithSrvSNI test failures
• Maintains compatibility for existing applications
• Adds test coverage in WolfSSLSocketTest

[cconlon]

I'm a little hesitant about this change, since I want to say we have had customers with failing connections until this behavior was added. Are we sure that SunJSSE only sets the SNI extension in the ClientHello when set in the SSLParameters, and doesn't pick it up if the SSLSocket is created using certain inputs?

Also, did we decide that this did indeed fix the SSLSocketExplorerWithSrvSNI test, or was that one that was broken by something else?

Thanks,
Chris

[gasbytes]

Hello Chris,

I've been thinking about your concerns regarding the SNI behavior change. You raise a valid point about potential customer issues. To address this while still fixing the test failure, I propose adding a new system property com.wolfssl.provider.jsse.autoSNI that would let customers opt into the legacy automatic SNI behavior if needed.

By default, we would only set SNI when explicitly configured through SSLParameters - fixing the test case and better aligning with standard JSSE behavior.
This way, we can maintain compatibility for customers who depend on the automatic SNI while also follow the JSSE behavior.

Would this approach address your concerns?

Thanks,
Reda Chouk

[cconlon]

@gasbytes Yes, that sounds like a great plan. I suggest adding it as a Security property (instead of System) for consistency with our other wolfJSSE configuration properties. I also suggest following existing Security property naming schemes and call it wolfjsse.autoSNI, which would be set from java.security like so:

wolfjsse.autoSNI=true

Please also update the README.md section on System Property Support once added, and add in a JUnit test that tests setting the property (Security.setProperty("wolfjsse.autoSNI", "true") if possible.